ALB vs NLB pricing: LCU math and the cost of Layer 7 load balancing

Published April 2, 2026

AWS lists the base price for both Application Load Balancers (ALB) and Network Load Balancers (NLB) at $0.0225 per hour. For a single load balancer running continuously in us-east-1, that works out to $16.43 per month.

On paper, the two services look priced identically. One inspects HTTP headers at Layer 7; the other routes TCP and UDP packets at Layer 4.

In production, variable pricing tells a different story. AWS charges for variable usage through capacity units: Load Balancer Capacity Units (LCUs) for ALB and Network Load Balancer Capacity Units (NLCUs) for NLB. The unit prices differ—$0.008 per LCU-hour versus $0.006 per NLCU-hour—and the dimensions used to compute those units differ by orders of magnitude.

Under workloads with high connection concurrency, such as WebSockets, mobile push fleets, or IoT telemetry, an ALB can cost ten to fifty times more than an NLB handling the exact same client traffic.

Here is the math behind LCU and NLCU calculations, why persistent connections trigger steep Layer 7 fees, and how to model the cost crossover point between native ALB routing and self-managed reverse proxies.

The baseline pricing model

Load balancer pricing across AWS consists of a fixed hourly rate plus a variable hourly rate determined by your peak capacity dimension.

According to pricing data in our networking section, rates in us-east-1 breakdown as follows:

Regional variations scale both base and unit rates. In São Paulo (sa-east-1), an ALB costs $0.0340/hr base plus $0.0110/LCU-hr, while an NLB runs $0.0340/hr base plus $0.00825/NLCU-hr. In Tokyo (ap-northeast-1), both balancers carry a $0.0243/hr base rate.

The deprecated Classic Load Balancer charges $0.008 per gigabyte without capacity unit discounts. On high-volume pipelines, CLB is almost always more expensive than modern alternatives.

Between ALB and NLB, the variable unit rate is 25% lower on NLB ($0.006 vs $0.008). The real financial divergence, however, comes from the capacity unit definitions.

LCU vs NLCU: The dimensional math

AWS measures load balancer capacity across several independent dimensions every hour. You pay only for the single highest dimension consumed during that hour.

Total Hourly Variable Cost:
  ALB = max(New Conns LCU, Active Conns LCU, Processed Bytes LCU, Rule Eval LCU) * $0.008
  NLB = max(New Conns NLCU, Active Conns NLCU, Processed Bytes NLCU) * $0.006

ALB: Load Balancer Capacity Unit (LCU)

One ALB LCU equals the maximum of:

1. New connections: 25 new TCP connections per second (or 5 new HTTPS connections per second with ECDSA certificates / ~25 with RSA).
2. Active connections: 3,000 concurrent active connections per minute.
3. Processed bytes: 1 GB processed per hour for standard HTTP/HTTPS traffic.
4. Rule evaluations: 1,000 rule evaluations per second (calculated as: New connections/sec * max(0, Evaluated rules - 10)).

NLB: Network Load Balancer Capacity Unit (NLCU)

One NLB NLCU equals the maximum of:

1. New connections (TCP): 800 new TCP connections per second (or 100 new TLS handshakes per second if TLS terminates on the NLB).
2. Active connections (TCP): 100,000 concurrent active TCP connections per minute (or 3,000 active TLS connections if terminating TLS).
3. Processed bytes: 1 GB processed per hour for TCP/UDP (or 0.4 GB per hour for TLS terminated on NLB).

Dimension-by-dimension comparison

NLB handles 33 times more active connections and 32 times more new TCP connections per capacity unit than an ALB, and bills that unit at a 25% discount.

Effective cost per 100,000 active connections/hour:
  ALB: (100,000 / 3,000) * $0.0080 = $0.2667/hr  ($194.67/month)
  NLB: (100,000 / 100,000) * $0.0060 = $0.0060/hr  ($4.38/month)

For maintaining 100,000 open TCP connections, an ALB costs 44.4x more in variable capacity units than an NLB.

The Layer 7 connection trap: WebSockets, gRPC, and IoT

This pricing asymmetry creates billing spikes for three specific workload patterns.

1. Long-lived WebSocket connections

Consider a real-time messaging application, multiplayer game lobby, or financial ticker. 100,000 connected clients keep idle WebSocket connections open for push notifications, transferring only 200 GB of aggregate data per day (~8.3 GB/hour).

Let’s calculate the monthly load balancer bill in us-east-1:

Workload parameters:
  - Active connections: 100,000 concurrent
  - New connections: 50 / sec
  - Bandwidth: 8.33 GB / hr
  - Balancer count: 1 (Multi-AZ)

ALB calculation:

• Fixed base: $0.0225 * 730 = $16.43
• Active connections LCU: 100,000 / 3,000 = 33.33 LCUs
• New connections LCU: 50 / 25 = 2.0 LCUs
• Processed bytes LCU: 8.33 / 1 = 8.33 LCUs
• Billed LCUs: max(33.33, 2.0, 8.33) = 33.33 LCUs
• Variable cost: 33.33 * $0.008 * 730 = $194.65/month
• Total ALB monthly cost: $211.08

NLB calculation (TCP passthrough with TLS at backend or TLS on NLB):

• Fixed base: $0.0225 * 730 = $16.43
• Active connections NLCU: 100,000 / 100,000 = 1.0 NLCU
• New connections NLCU: 50 / 800 = 0.0625 NLCUs
• Processed bytes NLCU: 8.33 / 1 = 8.33 NLCUs
• Billed NLCUs: max(1.0, 0.0625, 8.33) = 8.33 NLCUs (bandwidth is the peak dimension)
• Variable cost: 8.33 * $0.006 * 730 = $36.49/month
• Total NLB monthly cost: $52.92

When connection counts increase to 500,000 concurrent clients with low throughput:

• ALB jumps to 500,000 / 3,000 = 166.67 LCUs = $989.47/month.
• NLB requires 500,000 / 100,000 = 5 NLCUs (or bandwidth-bound at 8.33 NLCUs) = $52.92/month.

2. High-throughput gRPC streams

gRPC uses HTTP/2 multiplexing. While this reduces the rate of new TCP handshakes, continuous bidirectional streams maintain open connections for minutes or hours.

On ALB, gRPC streams incur active connection tracking at Layer 7. If gRPC microservices also evaluate host or path rules per request, rule evaluation units start climbing.

On NLB, gRPC traffic is handled as raw TCP streams. NLB bypasses HTTP/2 frame parsing, keeping CPU overhead and NLCU consumption minimal.

3. Rule evaluation scaling on ALB

ALB allows routing traffic based on HTTP headers, query strings, and path prefixes. However, rule evaluations are metered:

Rule Evaluation LCU = (New connections/sec * max(0, Rules evaluated - 10)) / 1,000

The first 10 rules processed for any request are free. But if your ALB evaluates 60 path and host routing rules, each incoming connection evaluates up to 50 billable rules:

Example: 4,000 new requests/sec across 60 rules
  Billable rules per connection = 60 - 10 = 50 rules
  Total evaluations/sec = 4,000 * 50 = 200,000 eval/sec
  Rule LCUs = 200,000 / 1,000 = 200 LCUs
  Monthly cost for rules alone: 200 * $0.008 * 730 = $1,168.00/month

A complex routing configuration with high request volume can easily generate thousands of dollars in rule evaluation charges alone.

Architectural comparison: Native ALB vs NLB + Envoy proxy fleet

To avoid Layer 7 pricing penalties while preserving HTTP routing capabilities, many organizations adopt an NLB-to-Envoy (or NLB-to-Nginx) architecture.

Architecture A: Fully managed ALB

Client ---> [ ALB (Layer 7 Routing + TLS) ] ---> [ Backend EC2 / ECS Tasks ]

• Pros: Zero infrastructure to patch, native ACM certificate renewals, managed AWS WAF integration, native Cognito authentication actions, target group health checking.
• Cons: $0.008/LCU-hr, limited to 3,000 active connections per LCU, rule evaluation charges, minimum latency overhead (~4–8 ms).

Architecture B: NLB + Self-managed Envoy on Graviton

Client ---> [ NLB (Layer 4) ] ---> [ Envoy / Nginx Proxy Fleet ] ---> [ Backend Services ]

• Pros: $0.006/NLCU-hr, 100,000 active connections per NLCU, zero rule evaluation fees, sub-millisecond load balancer latency, support for static Elastic IPs.
• Cons: You operate the proxy instances, configure Envoy routing, manage certificate deployments, and size the proxy fleet.

The compute cost crossover

Does running a self-managed proxy fleet cost less than paying ALB LCU fees?

Looking at instances pricing in us-east-1:

• A Graviton3 c7g.medium (1 vCPU, 2 GiB RAM, up to 12.5 Gbps network) costs $0.0363/hr ($26.50/month).
• A Graviton3 c7g.large (2 vCPUs, 4 GiB RAM, up to 12.5 Gbps network) costs $0.0725/hr ($52.93/month).

A 2-node HA proxy fleet using c7g.medium instances costs: 2 * $26.50 = $53.00/month.

An Envoy process on a single c7g.medium can handle over 30,000 HTTP requests per second and 150,000 idle TCP/WebSocket connections using less than 1.5 GiB of memory.

Monthly Cost Comparison for 300,000 Persistent WebSockets (10 TB/month data):

Option A: Managed ALB
  - Fixed Base: $16.43
  - Active Conns LCU: (300,000 / 3,000) = 100 LCUs -> $584.00
  - Processed Bytes LCU: (10,000 / 730) = 13.7 LCUs (subsumed by active conns)
  - Total: $600.43 / month

Option B: NLB + 2x c7g.medium Envoy Fleet
  - NLB Fixed Base: $16.43
  - NLB Active Conns NLCU: (300,000 / 100,000) = 3 NLCUs
  - NLB Processed Bytes NLCU: (10,000 / 730) = 13.7 NLCUs (peak dimension)
  - NLB Variable: 13.7 * $0.006 * 730 = $60.01
  - EC2 Proxy Compute: 2 * $26.50 = $53.00
  - Total: $129.44 / month

Net Savings with NLB + Envoy: $470.99 / month (78% reduction)

At 1,000,000 concurrent connections, the ALB costs over $2,450/month, while the NLB + Graviton fleet costs under $280/month.

Workload cost comparison matrix

The table below compares estimated monthly load balancer expenses across three typical workload profiles in us-east-1.

Decision checklist: When to use ALB vs NLB

Use this checklist when selecting a load balancer for new architectures:

1. Choose ALB when:

   • Traffic consists of short-lived request/response HTTP/HTTPS cycles.
   • You need managed features like AWS WAF integration, OIDC/Cognito authentication, or HTTP header transformations without running proxy software.
   • Concurrent active connections remain under 10,000 per balancer.
   • You want zero operational overhead for reverse proxies.

2. Choose NLB when:

   • You run persistent connection protocols: WebSockets, MQTT, long-polling, or continuous gRPC streaming.
   • You need static Anycast or Elastic IP addresses per Availability Zone for client firewall whitelisting.
   • You handle raw TCP, UDP, or non-HTTP protocols.
   • Your application requires ultra-low sub-millisecond network latency.
   • Your connection counts exceed 50,000 concurrent clients, where LCU active connection charges outweigh the operational cost of running self-managed Envoy or Nginx on c7g.medium or c7g.large instances.